Network analysis studies connected entities and their transactions as a graph to detect coordinated behavior that isolated alerts never reveal. Money cycling through a cluster of accounts, or many accounts funneling to one beneficiary, only becomes visible when you look at the whole structure at once.
What is network analysis, in plain English?
Serious money laundering is rarely a lone transaction; it is a system of accounts working together. Network analysis treats the whole system as a graph, where entities are nodes and their transactions are the edges between them, then studies that graph to find coordinated behavior. Patterns like money cycling around a cluster, or dozens of accounts all pointing to a single beneficiary, jump out at the graph level even though each individual account looks unremarkable.
It extends link analysis. Where link analysis draws the connections between entities, network analysis studies the resulting structure as a whole to detect organized rings, layering topologies, and smurfing networks. It is the difference between noticing that two accounts share an address and recognizing that fifty accounts form a laundering machine.
The practical output is prioritization. Network analysis can rank the densest, highest-risk clusters so analysts work the worst networks first, instead of chewing through alerts one unconnected account at a time.
How network analysis surfaces a ring
- Build — Assemble the graph. Entities become nodes and their transactions become edges, forming a map of who moves money to whom.
- Detect — Find the structures. Cycles, fan-in to one beneficiary, and dense clusters reveal coordination invisible at the single-account level.
- Rank — Score the clusters. The highest-risk networks are ranked so analysts can work the worst first rather than at random. Legitimate densityBusy but benignA high-volume marketplace looks dense too; without establishing intent it can be mistaken for a ring.Coordinated ringReal launderingCycling funds and convergent flows with no business rationale point to an organized network.
- Investigate — Work the network as one case. The cluster is investigated together, so the whole ring is documented rather than picked at account by account.
What it looks like in practice
In practice
An analyst runs network analysis across a segment of newer accounts and one cluster lights up: thirty accounts where funds arrive from outside, hop between the group in small amounts, and reconverge into three accounts that wire the total abroad each week. No single account ever tripped a meaningful alert.
The graph makes the smurfing structure obvious, and the cluster ranks near the top on risk. Before escalating, the analyst checks whether the density could be a legitimate business network; the accounts share no plausible commercial purpose and the cycling has no business rationale. She works the whole cluster as one case, and a single investigation documents an entire laundering ring instead of thirty disconnected reviews.
Why it matters to operators
The core insight is that serious laundering is a network, not a lone transaction. Rings, layering structures, and smurfing operations are built to disperse activity so that no single account draws attention. Only by studying the connected structure can a program see the coordination and act on the whole scheme at once. Ranking the highest-risk clusters also lets scarce analyst time go to the worst networks first, which is a real efficiency gain over working an undifferentiated alert queue.
Two pitfalls temper the promise. The first is computational noise at scale: on a large graph, weak or spurious connections can overwhelm the real signal if the analysis is not tuned. The second is mistaking legitimate density for suspicion. A busy commercial marketplace is a dense, highly connected network too, so intent has to be established before a cluster is treated as a ring, or the program ends up investigating ordinary commerce.
Operator notes
- Rank, do not just detect. The value is in prioritizing the densest, highest-risk clusters so analysts work the worst networks first.
- Establish intent before calling a ring. A busy legitimate marketplace is dense too; confirm there is no business rationale first.
- Watch for cycles and fan-in. Money circling a cluster or many accounts converging on one beneficiary are classic laundering topologies.
- Mind the scale noise. On large graphs, weak links can drown the real signal; tuning matters as much as the algorithm.
- Work the cluster as one case. Documenting the whole network together beats picking at individual accounts in isolation.
Quick questions
How is network analysis different from link analysis?
Link analysis identifies the connections between entities, often to widen a single case. Network analysis studies the full connected structure as a graph to detect coordinated behavior across it, such as rings and layering topologies. Network analysis builds on the links that link analysis finds.
What structures does it detect?
Cycles where money circulates through a cluster, fan-in where many accounts converge on one beneficiary, and dense clusters of accounts acting together. These are the signatures of organized rings, layering, and smurfing networks.
How do you avoid flagging legitimate networks?
By establishing intent before concluding. High-volume commercial ecosystems like marketplaces are naturally dense and connected. Suspicion should rest on activity that lacks a business rationale, not on connectivity alone.
Why rank the clusters?
Because analyst time is limited. Ranking the highest-risk networks lets a program attack the worst laundering structures first, rather than working an undifferentiated queue where a major ring gets the same attention as a benign account.
What is the main technical challenge?
Computational noise at scale. On a large graph, spurious or weak connections can overwhelm the genuine signal, so the analysis has to be tuned to surface meaningful structures rather than coincidental ones.
Go deeper
- FinCEN ↗ — The US financial intelligence unit. Bank Secrecy Act rules, advisories, and SAR and CTR guidance.
- FFIEC BSA/AML Examination Manual ↗ — The manual US examiners use to assess BSA and AML programs.